The vulnerability allows an attacker who has a read‑only link share to list all link shares for a project and obtain the secret hashes that normally require higher privileges. By retrieving hashes for writes or admin shares, the attacker can authenticate as an administrator and fully control the project. This flaw is a classic example of inappropriate authorization logic (CWE‑285).

Vikunja, an open‑source self‑hosted task management platform, is affected. All releases before version 2.2.2 are vulnerable. The issue is fixed in version 2.2.2 and later.

The CVSS base score of 7.5 classifies this as a high‑severity issue, but the EPSS score is below 1 %, indicating low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to a read‑only link share and network access to the Vikunja instance, meaning an attacker can perform the attack remotely if they obtain or guess a legitimate link.